Posted
by
kdawson
on Tuesday November 23, 2010 @05:33PM
from the unfair-exchange dept.

Xenographic writes "NPR has a story about someone whose personal iPhone got remotely wiped by their employer. It was actually a mistake, but it was something of a surprise because they didn't believe they had given their employer any kind of access to do that. This may already be very familiar to Microsoft Exchange admins, but the problem was her iPhone's integration with MS Exchange automatically gives the server admin access to do remote wipes. All you have to do is configure the phone to receive email from an MS Exchange server and the server admin can wipe your phone at will. The phone wasn't bricked, even though absolutely all of its data was wiped, because the data could be restored from backup, assuming that someone had remembered to make one. But this also works on other devices like iPads, Blackberry phones, and other smartphones that integrate with MS Exchange. So if you read your work email on your personal phone or tablet, you might want to make sure that you keep backups, just in case."

No, that wouldn't wipe a phone or raise questions about it being bricked if not for backups. Did you even read the summary?

This is more like the inverse or the equal-and-opposite of (previous?) MS e-mail clients that would automatically execute code from unknown sources as a "feature". Instead of an MS e-mail client it's an MS e-mail server, and instead of downloading and executing code automatically without asking the user to confirm it wipes the phone automatically without asking the user to confirm.

The solution is a simple one. If a company requires you to use a phone for business purposes that will be sending/receiving business e-mails and subject to remote wiping by that company, then that company needs to issue phones to their employees that may not be used for non-business purposes. Then there wouldn't be any problems with a company wiping a phone that is actually company property.

I don't think most people read it but when you think about the type of proprietary (and often confidential) data your email inbox has, you have to understand why the company does it.

That's a perfectly acceptable policy for any company that provides smart phones to its employees. I don't know if it's true with your company, but I would consider that an overreach if you want me to connect my personal phone with your network and give you the ability to delete all of my pictures and other personal data solely at your discretion. I'm sure you would understand why the owner would find that objectionable.

You can only remote wipe something which connect to the internet and is not in offline mode. Even all the best iphone ipad, PDA, will not remote wipe if it do not get the remote wipe command. Which would not happen if somebody is motivated enough to cleverly remove any connection capability before going through the mailbox offline mode. And somebody stealiong it and not sophisticated enough to know that would not even care about the data, almost cetrainly. So it is really a useless feature.

Also, from the wikipedia article on the product, someone did try boycotting it in 1999 (http://en.wikipedia.org/wiki/Spic_and_Span). I think that's stupid. "Spick and Span" was first recorded in the 16th century. "Spic" has only existed since early 1900s, wasn't documented until 1910, and even then was documented as "spiggoty" as a slur against Italians. I'd say it's pretty safe to say that when "Spic and Span" was created (1933 in Ohio), "spic" being a slur wasn't even on the radar for them.

I think the situation is similar to the word "niggardly" (http://en.wikipedia.org/wiki/Controversies_about_the_word_%22niggardly%22). People see something that, without any context (context like the spelling of the word or idiom...), could be conceived as racist. People take offense as something because of their own ignorance.

The problem is, you're not being color-blind. You're seeing color issues where there aren't any. You're trying to get people riled up at racism that isn't even there. You're not helping to stop racism, but you are helping to chill language and communication and encourage ignorance. You have, by trying to be on the right side of something, wound up on the wrong side of everything.

I have the same thing here. I always inform staff that I can and will wipe their phones. At their request, and that they should inform me at once if they lose of have their phone stolen.
My personal iphone is connected to a gmail account that I forward a copy of all my work email.
That way I get work email, but it is still my account.

It's that simple. It's the company's data, not your personal data, and they have measures in place to protect it. If you don't want to abide by those measures, you don't have to.

At least in the US, if you're required to provide equipment required by your job, and your employer doesn't pay for it, then you can write it off on against your personal tax burden. So if you find yourself in that rare situation where work requires you have a smartphone, and won't pay for it, get one separate than your private phone and save on your taxes at the end of the year.

What do you do to protect your employees interests in not having their own data annihilated by accident?

Also, are you expecting employees to take work with them, using their own devices; or is the company willing to bare the costs of either providing a device or the work not being done?

It would seem most unusual to me for an employer to require their employees to provide expensive equipment for company use, and with the agreement that the company may treat it as its own.

Simple - don't give company access to your personal phone.

If the company wants you to have mobile email, they can pay for it themselves - after all, you're just as likely to not have a smartphone as to have one, so if the employer wants you to have one, they can provide it. I don't see why I should pay for a data plan on my phone that my employer can eat into. What - I went with a 100MB plan and you sent me 200MB of email? I'm not paying the extra $500 that usually costs.

The usual reason why personal iPhones and such are being connected to company networks is simple - the employee wishes to have their email (or needs to have it) and doesn't want the company standard blackberry, or to carry two phones, or other reason. Of course, most companies balk at using personal equipment connected to the corporate networks, either. Still, if you have to have email, either take the company hardware and deal with that issue (better) or use your own hardware and deal with remote wipe (worse option). Most people prefer carrying around just their iPhone instead of iPhone+Blackberry, though.

I only give my personal phone to selected people in my company. That would be my boss and with the explicit notice that it is a private number and should only be used in case of emergencies.

If they want me to have a device to connect to their system, they should provide me with one. Just like I expect them to provide a desk and a chair to sit on. Then it is theirs and they can do with it as they please and at the end of employment, they will get it back.

It's to protect the company's interests should a phone be lost or stolen.

I don't think that wiping the entire phone's data goes far enough to protect their interests. Every company should have the ability to remotely wipe your smartphone, and your home computer, and the computers of all family and friends within 6 degrees of separation. Also, they should be able to kill you, because your brain contains precious precious data, too. Really, they ought to be able to take off and nuke the entire site from orbit. It's the only way to be sure.

Way too far is not enough, I say, when it comes to protecting a company's interests.

The solution is a simple one. If a company requires you to use a phone for business purposes that will be sending/receiving business e-mails and subject to remote wiping by that company, then that company needs to issue phones to their employees that may not be used for non-business purposes.

Why require they be used strictly for business? If the user is willing to take the risk of losing it all, then let them. One less low-value rule to worry about enforcing.

In most companies, it is expected that equipment bought and paid for by the company is to be used only for business purposes. This is standard practice with company computers, landline phones, etc. Not to mention it's rather unprofessional to conduct your personal business while you're on the clock and certainly a sign of poor time management.

Also, I support the notion of private property when I retain the right to eject an unwanted person from my home. I likewise support the notion of private property when a company that lends you a phone and pays all the costs of that phone gets to tell you how you may use that phone.

Now the requirement that company-paid phones should only be used for business might be backed up by potential disciplinary action. Or it might be backed up by "our company data has been secured; don't cry to us if you put something else on there and now it's gone". Either way is alright by me, and which one it is would be up to the company and employees to work out.

If an Employer *wants* its Employees to be reading their email from cell phones and the Employee doesn't feel like using their own personal property to do so, then the Employer needs to buy the Employee a work owned device or "STFU". If the Employee doesn't want to carry around two devices then they either need to submit to their phone being wiped or "STFU" and carry around both devices.

So you want me to have to carry around a second device because some dev is too lazy to isolate the e-mail stored on my phone from everything else?

I meant the protection is for the company's data. It's their data, and their protection. You don't like what their protection does to your phone and your data? Then don't hook up your phone to their systems.

It's just like having a personal laptop. Would you bind your personal machine to the company's AD environment, giving them full administrative control? No? Then don't use your personal machine on their network. Use a company-provided machine, or a work-dedicated machine that you can write off on your tax return.

It's just like having a personal laptop. Would you bind your personal machine to the company's AD environment, giving them full administrative control? No? Then don't use your personal machine on their network. Use a company-provided machine, or a work-dedicated machine that you can write off on your tax return.

I use my personal machine at work every day. I connect via standard protocols like ssh and smb, and never give up admin control, nor would I ordinarily do so. If they explicitly asked me to, I would say no, buy me a company machine instead, but if they said, "hey, if you install this software you can connect to our email servers" I don't really think it would occur to me to go check if the ordinary behavior of that software gives them root on my box. That wouldn't even occur to me.

Of course one reason such "massive security breaches" happen is that companies have stupidly draconian policies which make "normal" operation so annoying/dangerous that clueful employees bypass it as a matter of course.

Yeah, they can threaten "you might be fired!", but threats are very rarely effective unless they coincide with common sense — which policies like "we can wipe whatever we want!" don't.

I suppose the larger the company, the more likely they are to choose "draconian/bluster" over working with the employees to find an agreeable technical solution...

I have the same thing here. I always inform staff that I can and will wipe their phones. At their request, and that they should inform me at once if they lose of have their phone stolen.

My personal iphone is connected to a gmail account that I forward a copy of all my work email.

That way I get work email, but it is still my account.

I guess I'll pile on, too...

Depending on where you live and what you do, HIPAA has some exciting new personal liability built right in at no extra charge! So when that claims processor blasts PHI out to the wrong e-mail list, you, sir, have just transferred and stored it in a manner that will have you in court by yourself. Just you in the "Little Old Lady Victim vs. Evil (your name here)" By this time your employment will be a distant memory and your former company has no obligation to defend you. Depending on the company's policies and compliance they will get dinged, but that is a cost of doing business and a separate process that has nothing to do with your personal liability. Have you planned financially for that scenario?

Then the simple solution is to not use your personal phone to check your business e-mail. If my employer wants me to check my e-mail when I am out and about, then they can provide me with the equipment to do so. Otherwise I will not use my personal phone to check my business e-mail.

I suppose it depends on the work environment, but we regularly deal with sensitive customer information (i.e. financials, SSNs, credit cards, etc) and this sort of information ends up in internal emails.

Sending an e-mail containing someone's credit card details should be a criminal offense.
Anyone who e-mailed SSNs internally should go to jail for doing so.
Shoddy security practices by people in an organization in no way justify the destruction of someone else's property.

E-mailing sensitive financial details of customers is an utterly reckless practice, and trying to "wipe a terminated employee's phone" doesn't address the security issue at all.

Carrying around such sensitive information as CCs/financials on a mobile device without strong cryptography and basic security is at diametrical opposite to safeguarding corporate data.
And frankly, the organization deserves what they get if they fail to prohibit the practice or fail to promptly terminate employees who adopt a practice of doing so.

The simple fact is anything truly critical such as that should not be available on anyone's Blackberry, iPhone, or any device taken off of company property, aside from encrypted formats where the decryption keys are not available on the device without a secure authorization process.

So if you want remote access to your corporate mail, you do it on a company-supplied device and accept they have full control. If you want the convenience of using your personal phone with their exchange server, you accept that this includes the remote wipe nuclear option. The company gets to choose the policies for securing its own data, you get to choose if you bring your personal device to the party or not. It only becomes a problem if a company does something dumb like mandates you use personal phones to connect to their exchange environment and in my experience this pretty much never happens: it's people who go "Oh cool, my iPhone does Exchange! " and connect it to their corporate network for convenience that'll be affected by this.

My company doesn't require me to have a smartphone, to read my emails from home, to take my laptop home, to work on evenings or weekends, or to do anything that anybody here would object to.

They also fire the few worst performers in every department just about every year.

That means that EVERYBODY uses their personal phones for work, distributes their cell-phone numbers, reads emails from home, takes their laptops home, works on evenings and weekends, and does all kinds of stuff that everybody here would object to.

Sure, it isn't "policy" but if you don't do it you just lose your job anyway.

That means that I care about stuff like this.

It isn't a big deal - when I get around to it I'll just use a patched email client that handshakes with the server and agrees to wipe my phone and do all that intrusive stuff that makes corporate happy, and then silently ignores any such requests. It will of course confirm that it is doing all of that stuff anytime the server asks it to.

The only way the company is going to know if my phone is running the code that they think it is running is when they supply the phone - so the problem has an easy solution.

It would seem most unusual to me for an employer to require their employees to provide expensive equipment for company use, and with the agreement that the company may treat it as its own.

Why do you think the USA has such a high level of productivity? EVERYBODY expects their employees to do this stuff. Sure, it isn't written policy, but if you don't do it you "aren't competitive."

Why would the employer pay for an employee to use a cell phone when they can just fire the slowest worker every year and pretty soon everybody is happily volunteering their personal phone numbers to keep their jobs?